HOLLOWGRAPH MALWARE HIJACKS MICROSOFT 365 FOR C2

Security researchers have identified HollowGraph, a malicious component that weaponizes Microsoft Graph API to establish hidden communication channels within Microsoft 365 environments. The malware leverages the calendar feature in compromised mailboxes to receive commands from attackers and exfiltrate stolen data. By operating through legitimate Microsoft services, HollowGraph evades traditional security detection mechanisms that typically monitor external network traffic. The use of Microsoft Graph API represents an increasingly common evasion technique. Attackers abuse legitimate cloud services to blend malicious activity with normal business operations, making detection significantly more difficult for defenders. Organizations using Microsoft 365 should review mailbox access logs, monitor for suspicious calendar modifications, and ensure multi-factor authentication is enabled across all accounts. Security teams should also monitor API usage patterns for anomalous behavior indicative of compromised credentials.